fix: #3637261 Drop "secure-http": false from composer.json, which puts an error on the status report

Issue: https://www.drupal.org/project/webship_project/issues/3637261

composer.json no longer sets "secure-http": false, so Composer requires HTTPS for downloads, which is what Package Manager's readiness check expects. The history shows no reason to keep it: the setting came with the first commit of the project (3d6b9f2b, 2017-06-08, "Setup the starter webship-project.") without a stated reason, while the only repository, packages.drupal.org, was already on HTTPS. A built site has no plain HTTP download URL: 0 of the 521 in its composer.lock.

Verified on a Webship 12.0.x site: composer config secure-http goes from false to true and the status report loses "HTTPS must be enabled for Composer downloads"; the separate "Unsupported Composer plugins were detected" error then shows and is not part of this change.

AI-Generated: Yes

Checkpoints

• File an issue
• Fix bugs in code
• Testing to ensure no regression
• Automated unit testing coverage
• Automated functional testing coverage
• UX/UI designer responsibilities
• Readability
• Accessibility
• Performance
• Security
• Documentation
• Reviewed by human
• Code review by maintainers
• Full testing and approval
• Credit contributors
• Review with the product owner
• Release Notes
• Release